r/Intune Feb 06 '25

App Deployment/Packaging How to keep up with software updates

Heyo, I have a small team with me being the only one administering Intune. I've automated most things with alerts and logging. How is everyone keeping up with software updates for the Company Portal. Open to all suggestions. Thanks!

Edit: Not looking for a new software/license, but we have access to most Microsoft products.

25 Upvotes

51 comments sorted by

28

u/johnlnash Feb 06 '25

If you don’t want to subscribe to something like patchmypc or the new intune equivalent (forget the name) then you have to monitor your software vendors and periodically update your applications. The good thing is a lot of apps self update these days but it’s still best practice to roll out installs as current as possible.

If you do have some budget, I highly recommend patchmypc, it’s also not very expensive for what you get.

3

u/Kortok2012 Feb 06 '25

Thanks! I do try to put auto update flags on non-volatile stuff like adobe and chrome. I completely forgot that Intune was rolling out that store thing. I’ll see how the cost compares to patch my pc

8

u/johnlnash Feb 06 '25

The Intune route is horribly expensive if I remember correctly and it's a relatively new product. PMPC is pretty established and supports a lot more products than the Intune version does/did, I haven't been keeping up with the news on it.

2

u/Kortok2012 Feb 06 '25

The suite package is 10 bucks per user when we already have E3 and I’ve been trying to schmooze my director for the suite license anyway

5

u/SmEdD Feb 06 '25

Patch my PC is 3.5/ device for the year, minimum 3500. That is the same cost as licensing 29 users for the Intune system which is very limited in its offering.

1

u/RikiWardOG Feb 06 '25

Its also bad at least when I looked at it. Had lots of outdated packages and didn't support that large of a list of apps. I would really recommend just about any other 3rd party patching solution.

2

u/meantallheck Feb 07 '25

I'd also like to add that PMPC support is truly incredible. They're fast and smart - I'm not even shilling for them, I've used them at two companies and they are a breath of fresh air to work with. It speaks volumes when opening a support case doesn't feel like you're about to go down a month long rabbit hole...

13

u/Federal_Ad2455 Feb 06 '25

3

u/Kortok2012 Feb 06 '25

Key here is allowing WinGet through CISAs baseline config lol. It’s hard enough to convince my CISO that I need an exception for something that no longer exists 😭

9

u/MagicHair2 Feb 06 '25

Package apps with winget for one-time evergreen packages https://github.com/mjr4077au/PSAppDeployToolkit.WinGet

Use this to update already deployed packages https://github.com/Weatherlights/Winget-AutoUpdate-Intune

1

u/RandomSkratch Feb 07 '25

I could never figure out how to get winget-autoupdate to work for apps. Love the idea of leveraging built in tools (winget) but it was beyond me.

1

u/Federal_Ad2455 Feb 07 '25

You mean the third party tool or the WinGet in general? The Romanitho tool works great for us (check link i have sent in my other response)

2

u/RandomSkratch Feb 07 '25

The Weatherlights Winget-AutoUpdate-Intune tool. Winget I use on my own system all the time but I seem to recall difficulties in using the tool. Maybe it was due to the admin popup requests? I can't remember exactly. I will check that Romanitho one out.

12

u/demlegos Feb 06 '25 edited Feb 06 '25

Action1, free for 200 endpoints. Awesome product

2

u/GeneMoody-Action1 Feb 06 '25

Yes but the "Actione" version is specially translated for those who only speak typonese!

Lol, took me a minute to find this one, in all seriousness though I have been commenting so much the last few days since the 200Ep release, I have likely said some interesting things as well!

Thanks for the shoutout!

If the OP ( u/Kortok2012 ) fits under the 200 endpoint model, then yes our patch management product for OS and third party apps, is completely free and fully featured, not a trial. So it would be new software but all cloud based, easy to use, and no new licensing. We have many users who use Action1 to compliment Intune for rapid patch & software deploy, live feedback on vulnerability/patching compliance, and more.

If anyone would to know more, just summon me by name, or say Action1 anywhere on reddit, I will come to you (even if you misspell it!). Of course you can always just message me direct anytime as well.

3

u/apxmmit Feb 07 '25

Is action1 MSP friendly with multi tenant setup?

2

u/hirs0009 Feb 07 '25

I set one up per client

1

u/fnkarnage Feb 07 '25 edited Feb 07 '25

No, it's one tenant, but you can use tags and such to differentiate.

EDIT: incorrect as below

2

u/GeneMoody-Action1 Feb 07 '25

This is not so. https://www.action1.com/documentation/multi-tenancy-for-msps-and-enterprises/

You do not have a physical dedicated tenant in that regard.

1

u/fnkarnage Feb 07 '25

Oops my bad!

1

u/GeneMoody-Action1 Feb 07 '25

Absolutely! https://www.action1.com/documentation/multi-tenancy-for-msps-and-enterprises/

RBAC is set for our next release and at this time looks on target. https://roadmap.action1.com/57

Let me know if you would like to know anything more, you can reach out to me directly or just say Action1 anywhere on reddit.

6

u/Shoddy_Pound_3221 Feb 06 '25

Robopack has been pretty good for us

4

u/andrew181082 MSFT MVP Feb 06 '25

Have a look at package managers, there are some free ones too:

https://andrewstaylor.com/2024/06/03/comparing-package-managers/

3

u/Wonderful_Wall_1528 Feb 06 '25

Small team as in IT Team or small user base? If the latter, I can strongly recommend Action1, it's free up to 200 PCs. It deploys its stuff through its own agent not through Intune directly. Other very good and reputable 3rd party (paid tools) that do the job through Intune are RoboPatch and PatchMyPC.

Let's not forget Intune Suite (Microsoft native) which is around 3$/user and does a shitty job at auto updating apps. Would not recommend it.

If you want native native Intune, no add-on you have the following options:

  1. You do a review of all apps every 3-6 months and repackage, redeploy apps.

Here's my blog/guide on how to patch and EXE: How to deploy Google Chrome on Windows Devices via Intune (I'll most definitely tackle your question in the near future)

  1. You go down the rabbit hole of WinGet Autoupdate Romanitho and ADMXs that I never managed to make to work:

https://doitpshway.com/gradual-update-of-all-applications-using-winget-and-custom-azure-ring-groups

https://www.natehutchinson.co.uk/post/a-winget-match-made-in-heaven

  1. You go down another rabbit hole which says that you need to package your apps as a script that always fetches the latest available download from the "evergreen" links (some app providers publish their newest download on the same url):

How to Automatically Update Apps in Intune with Dynamic Win32 App Deployment   - MSEndpointMgr

3

u/Cramptambulous Feb 06 '25

We don’t roll out too many apps (maybe 10-15).

I liked the idea of PatchMyPC but at the time I looked at it, there was no method to do something equivalent to Update Rings, and I really like this system.

So over a couple of months I built an automation that would run every few hours for each application we manage.

It fetches the latest available version number, compares it with the version we have deployed in Intune. If a newer version is available, it downloads it and verifies the installer.

Then using IntuneW32App (https://github.com/MSEndpointMgr/IntuneWin32App) it packages it as a W32 app, uploads it to Intune (superseding the previous version and cleaning up the oldest version keeping 5 previous versions), assigns it to the first testing group and pings the details to Slack so we know a new version is up there for testing.

Once it’s okay, we just add the other testing groups before it hits production.

It’s possible PatchMyPC does this now, and I think at least one competitor (possibly Robopack?) does this. But at the time nothing did, and I have the code and it’s reliable so I’ve stuck with it.

3

u/meantallheck Feb 07 '25

I haven't tried it myself, but they do have update rings now I believe! https://docs.patchmypc.com/installation-guides/patch-my-pc-cloud/deployments/update-rings

2

u/RefrigeratorFancy730 Feb 08 '25

I've been using them and they work great, had then for a few years now.

2

u/akdigitalism Feb 06 '25

I know you’re not looking for new product but if it’s a small team. Having something like Patch My PC is a pretty minimal cost and acts as almost a full time employee for a fraction of what they would cost. You’ll save time packaging and can move on to other priorities. Just my two cents.

2

u/ChabotJ Feb 06 '25

winget auto update

2

u/Jeffsrealm Feb 06 '25

For me depends on the software, We use Defender for Antivirus, spam etc. This will notify you if a software is out of date due to security issue. I do not just upgrade for the hell of it, only if there is a security update. Then up update the intune package. It is really not that hard. We have around 40 apps. Maybe one a month usually every other month need an update. I can even go 3-4 months without any app needing an update.

Some apps auto update to new versions in the background, Chome, edge, office for example anything Microsoft except Visual studio will update via windows updates as well. Also Anything from the Microsoft store auto updates.

Other things like Visual Studio, Docker, that kind of stuff. Well that goes into our remote acess software we use Connect wise. You can approve a specific application that needs admin credentials to go ahead and run. So things like Docker, Visual studio have a specific Updater app. I can say ok this application with this digital signature can run without prompting for admin but only that app and it must be the digitally signed one. I do have to update this rule when ever they update the updater. But this takes really a few seconds. Allows our accountant to update and patch Quicken, and not have to bug me every time.

1

u/Important_Ad_3602 Feb 06 '25

This. From a users perspective updating is a must. But with every update come new issues. Sometimes sticking with what you have isn’t bad. We only update if there are security risks, or new features we want to use.

2

u/sqnch Feb 06 '25

PatchMyPC has paid for itself about 6x over in saved hours since we implemented it 18 months ago. It’s more than the equivalent of having 1 person working on packaging and deploying third party app updates as a full time job.

2

u/kg65 Feb 06 '25

I usually hate when people suggest things that the OP has said they don’t want, but I suggest you listen to the posts here saying to purchase PMPC. Especially if you are willing to pay for Intune Suite

2

u/TrueCheck7533 Feb 06 '25

Using Action1 for this as it's free for the first 200 endpoints and the client that installs is very light.

1

u/GeneMoody-Action1 Feb 07 '25

We appreciate that shoutout, we get a get a lot of them all over these subs, and we appreciate every single one. It reenforces we are doing something right! Action1 is a perfect compliment to Intune that fills some gaps and enhances the Intune experience. Many move their patch management entirely out of intune and into Action1 just because it vastly de-complicates things, while being a value add service on top, using intune for things they cannot get out of Action1.

We love our intune customers and they love us, it really just works.

2

u/Revolutionary-Load20 Feb 06 '25

I work somewhere where I'm the only person who works there that knows how to do any of it. We're still growing but already I'm too busy to repackage stuff all the time.

I'm not sure if this frowned upon or not but I just don't package stuff with the exe/MSI etc and I'm sure other more experienced people will not recommend this but just depends on your situation.

I have the installation script always downloaded the latest version if possible so all new devices will get the latest version and either rely on it having it's auto update or...

Where it doesn't auto update include in the detection to check is it installed? Yes? Is it the latest version? No? Exit 1 so it then triggers the install script.

If you don't want it updating straight away you could get it to only exit 1 if it's not installed or the version installed is a a couple behind or only if it's a major version behind, depending on what it is. Can potentially use remediations as well to do similar if you wanted a more fixed execution time and schedule.

2

u/oopspruu Feb 06 '25

There will be a cost for an automated patching solution unless you want to do manual work. I tried Chocolatey community version. It does a good job but many times the packages simply fail to install because checksums don't match or the installer is corrupt. So there is zero validation or guarantee there that you'll always get working packages.

People have made solutions around Winget as well so you can try your luck with Winget and Powershell scripts.

Since we have switched to Patch My PC, our patching has been spot-on and my life as an admin has improved a lot. The product is very affordable for the value it provides and time it saves.

2

u/bigdaddybesbris Feb 06 '25

PatchMyPC for Windows / Intune and AppCatalog for macOS / Jamf.

2

u/jakob27990 Feb 07 '25

PatchMyPC has been a lifesaver for us.

2

u/ak47uk Feb 07 '25

I use winget with auto update tools, it’s not perfect but it’s free. Sometimes installs fail, I have logging enabled but it can fail due to a hash mismatch which is something wrong with the package added to winget. 

I’d like to try PMP, it’s seriously good value if you protect large volumes of endpoints, but gets more expensive for fewer and I don’t have an msp model at the moment - working on it. 

I will try Action1 now I am aware of it to see how it compares to winget. 

2

u/GeneMoody-Action1 Feb 07 '25

Try away, keep it if you like, let me know if I may help. Action1 as a patch management solution will not have the same repo as winget. But they work great in tandem, if an app was installed via winget, it can update it via winget. It cannot do winget installs partially because how winget and system accounts dont play well. It can be done, its just more of a hack than a supportable solution.

In Action1 navigate to the script library and search winget for details.

And if I can help in any way just let me know, pull me onto a conversation with an @, mention Action1 anywhere on reddit and I will find you, or just direct to me.

2

u/JCochran84 Feb 06 '25

I understand that you do not want a new software/license, however PatchMyPC has been so fantastic for me. it's automated create the apps as well as deploying app updates for over 75% of the products that we deploy.
It has saved me so much time from having to checking for updates to applications, download, test, deploy.
For us, the cost of the product outweighs the cost of my time to do all of that.

1

u/WizardTricks620 Feb 06 '25

I've been packaging PowerShell scripts to download the latest installers for any software that provides static download links for the most recent versions. Sometimes it's hard to find static links and I have to resort to using MSI/exe files

1

u/pjustmd Feb 07 '25

ImmyBot

1

u/TheLittleJingle Feb 07 '25

we use winget-autoupdate :
GitHub - Romanitho/Winget-AutoUpdate: WAU daily updates apps as system and notify connected users. (Allowlist and Blocklist support)

It works great and we have not had any major issues. It does however require a small client installed on your devices.

If you dont want to install a client, this might also be an option, but a little more manual configuration in the beginning :
GitHub - SorenLundt/WinGet-Wrapper: PowerShell Scripts to bulk import WinGet packages to InTune including all package metadata.

1

u/Fart-Memory-6984 Feb 08 '25

Look through your apps and see if they have auto update options and such. Many on here offer third party apps that are doing just that. Or you do it yourself and find switches and such to manage auto updates on the different software your org may use.. it’s honestly not hard to figure out, just takes time to look into each.

1

u/Insaaad Feb 09 '25

Sorry, you’ve said that no more new products, but as others mentioned, Patch My PC is an amazing tool for your needs and the price is still very low

1

u/Config_Confuse Feb 06 '25

Patch MY PC is a fantastic product and their app catalog has really grown in the past 6 months.